fix: version display, FileBrowser auto-login, nostr relay, UID mappings

Version per build:
- Health endpoint returns "1.2.0-alpha-{git_hash}" using GIT_HASH env
- CI passes git hash to cargo build

FileBrowser auto-login:
- filebrowser-client.ts: include CSRF token + credentials:include
- First-boot: generate random password, store at secrets/filebrowser/
- Set FileBrowser admin password to match after container creation

Nostr relay:
- Use docker.io/scsibug/nostr-rs-relay:0.9.0 (not in our registry)

UID mappings:
- Added electrumx (UID 1000), mysql-mempool, archy-btcpay-db, nextcloud-db

522 tests pass, Rust compiles clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

neode-ui/src/api/filebrowser-client.ts

@@ -55,11 +55,17 @@ class FileBrowserClient {
   async login(): Promise<boolean> {
     try {
       // Get a filebrowser JWT via the authenticated backend (no credentials exposed to browser)
+      // Use credentials: 'include' and CSRF token for proper auth
+      const csrfMatch = document.cookie.match(/(?:^|;\s*)csrf_token=([^;]+)/)
+      const csrfToken = csrfMatch ? csrfMatch[1]! : ''
+      const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+      if (csrfToken) headers['X-CSRF-Token'] = csrfToken
+
       const rpcRes = await fetch('/rpc/v1', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
+        headers,
         body: JSON.stringify({ method: 'app.filebrowser-token' }),
-        credentials: 'same-origin',
+        credentials: 'include',
       })
       if (!rpcRes.ok) return false
       const rpcData = await rpcRes.json()